"""Settings loaded from environment (.env in the project root, chmod 600).

Secrets are verified by SHAPE only (present / non-empty) — never echoed.
Per /srv/projects/standards/coding.md: no secret ever appears in code,
config examples, commit history, chat, or logs.
"""
from __future__ import annotations

from functools import lru_cache

from pydantic import Field
from pydantic_settings import BaseSettings, SettingsConfigDict


class Settings(BaseSettings):
    model_config = SettingsConfigDict(
        env_file=".env", env_file_encoding="utf-8", extra="ignore"
    )

    # --- core ---
    database_url: str = Field(default="", alias="DATABASE_URL")
    # Public origin of this app (no trailing slash) — used to build the BW
    # redirect_uri (<domain>/auth/callback) and the sign-out return URL.
    app_domain: str = Field(
        default="https://garden2.riverway.ca", alias="BW_APP_DOMAIN"
    )
    # Domain mode (see BW Auth Pattern B): public | password | account.
    # garden2 is "public": own welcome page + silent auto-signin for SSO'd
    # visitors.
    domain_mode: str = Field(default="public", alias="DOMAIN_MODE")

    # --- BW Auth (Pattern B / "Sign in with BW") ---
    # id-auth is the identity broker; bw_auth.py reads these from the env
    # directly (client_id/secret via .bw-auth.env). Mirrored here only for
    # shape reporting — the app never signs with the client_secret in Python
    # config (bw_auth reads os.environ at call time).
    bw_client_id: str = Field(default="", alias="BW_CLIENT_ID")
    bw_auth: str = Field(default="https://auth.bowden.works", alias="BW_AUTH")
    # Secret that signs THIS app's own session cookie (username|exp|sig).
    # Distinct from the BW client_secret; mode-600 .env, never argv/logged.
    app_session_secret: str = Field(default="", alias="APP_SESSION_SECRET")
    # App session lifetime (days).
    app_session_days: int = Field(default=30, alias="APP_SESSION_DAYS")

    # --- AI providers ---
    gemini_api_key: str = Field(default="", alias="GEMINI_API_KEY")
    anthropic_api_key: str = Field(default="", alias="ANTHROPIC_API_KEY")

    # --- notifications ---
    vapid_public_key: str = Field(default="", alias="VAPID_PUBLIC_KEY")
    vapid_private_key: str = Field(default="", alias="VAPID_PRIVATE_KEY")
    telegram_bot_token: str = Field(default="", alias="TELEGRAM_BOT_TOKEN")
    telegram_webhook_secret: str = Field(default="", alias="TELEGRAM_WEBHOOK_SECRET")

    # --- paths ---
    data_dir: str = Field(default="/data", alias="DATA_DIR")

    def secret_status(self) -> dict:
        """Shape-only presence report for startup logging. Never values."""
        return {
            "database_url": bool(self.database_url),
            "app_session_secret": bool(self.app_session_secret),
            "bw_client_id": bool(self.bw_client_id),
            "gemini_api_key": bool(self.gemini_api_key),
            "anthropic_api_key": bool(self.anthropic_api_key),
            "vapid_keys": bool(self.vapid_public_key and self.vapid_private_key),
            "telegram_bot_token": bool(self.telegram_bot_token),
        }


@lru_cache
def get_settings() -> Settings:
    return Settings()